Experiences with 'Pause actions of all alerts' as a form of ceasing Incidents generating in Ticketing Systems

Hi THWACK Community,

I am in an environment where the integration is achieved by ServiceNow collecting data from SolarWinds executing an action to write to the NetPerfMon Event Log.

When doing any maintenance or upgrades, I would previously Disable or Restrict the Integration Instance to ServiceNow from within SolarWinds to control this, but as there is no Integration Instance in this environment and it is controlled from ServiceNow side-of-things, I am unable to do this unless the ServiceNow administrators pause the collection from the Event Log from their end.

I would prefer to add another layer of ceasing integration, and was wondering if anyone has experienced where they have selected 'Pause actions of all alerts' on the Alerts & Activity page, but actions have still executed? Or has this been solid from your experience. I am a little pedantic, and due to the size of the environment and them being a customer, I want to be sure that if we use this route to cease the integration of incidents generating into ServiceNow during maintenance/upgrades, that this would be foolproof.

Also, apologies, I realise this post is a little lazy. There is some documentation and posts about this which have been helpful (such as @KMSigma.SWI suggestion to monitor the pausing from a database perspective, thanks I will definitely be using this - (+) Is there a way of monitoring whether Alerting is paused via the "pause actions of all alerts" option? If someone leaves Alerting Paused for too long I would like to know about it. - Alert Lab - The SolarWinds Platform - THWACK), and I aim to test this in a Lab just to be safe, but still wouldn't mind crosschecking with you all and perhaps this will help someone else in the future too.

Thanks, THWACK.

--t.m-k

Find more posts tagged with

integration

ServiceNow

alert design

Alerts

Comments

adam.beedell

Havnt had an issue with pausing other than people not unpausing.

Havnt used SNOW integration with a pause yet I think

You can script switching snow actions off to to dev or something in bulk if you need to. Perhaps breaking the instance. Seems unnecessary

mesverrum

I always pause alert actions when im about to restart my environment for upgrades or similar major events. It's pretty common for there to be a bunch of incorrect alerts trigger if the system is offline for a while.

vinay.by

Interesting - I am in an environment where the integration is achieved by ServiceNow collecting data from SolarWinds executing an action to write to the NetPerfMon Event Log.

How are they doing this ? Is it through SW API Calls ? Probably from ServiceNow or from some intermittent system used by ServiceNow to pull netperfmon log. If this is the case then for sure you should have an account as well created on SolarWinds, you can simply disable that account from Manage Accounts during a change or upgrade - if what I am suggesting is true. If not while the upgrade is happening ServiceNow will continue trying to connect to SolarWinds through the API calls which ideally shouldn't be done.

Or ServiceNow could be using some other mechanism to do so, maybe a ServiceNow agent of some sort which is deployed on your SolarWinds boxes - disable/stop the agent when you are upgrading SolarWinds. Check with them as to how exactly is this integration built and that will ease out the approach you take from there

I remember in the past the standard SolarWinds <-> ServiceNow Integration plugin doesn't work this way.

What you are trying to achieve here is not to write to NetPerfMon Event log during a change or upgrade - if this is what you need, you are absolutely correct, you can use Pause actions on all alerts and that would work well, but this wouldn't stop ServiceNow from connecting to your environment.

Hope this helps.

__PRESENT

t.m-k

Thank you @vinay.by

t.m-k

Thank you @mesverrum

t.m-k

Thank you @adam.beedell

adam.beedell

I had a thought about this over the weekend - Check if your SNOW integration definitively looks in the event log for alerts actions rather than alerts themselves, if it looks specifically for triggers and you dont add a specific "for SNOW"-thing then they may still trigger as alerts still function with actions off